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DETAILED ACTION 

1. Claims 1-2, 4-8, 10-16, 18-22, 24-30, 32-36 & 38-46 are pending. 

Response to Arguments 

2. In view of the pre-appeal conference request filed on 8/22/2006, PROSECUTION IS 
HEREBY REOPENED. New grounds of rejection are set forth below. 

To avoid abandonment of the application, appellant must exercise one of the following 
two options: 

(1) file a reply under 37 CFR 1 .1 1 1 (if this Office action is non-final) or a reply under 37 
CFR 1 . 1 1 3 (if this Office action is final); or, 

(2) initiate a new appeal by filing a notice of appeal under 37 CFR 41.31 followed by an 
appeal brief under 37 CFR 41.37. The previously paid notice of appeal fee and appeal brief fee 
can be applied to the new appeal. If, however, the appeal fees set forth in 37 CFR 41 .20 have 
been increased since they were previously paid, then appellant must pay the difference between 
the increased fees and the amount previously paid. 

A Supervisory Patent Examiner (SPE) has approved of reopening prosecution by signing 

below. 

3. It is noted that Applicant's amendments of 4/10/2006 to the claims are not in compliance 
with 37 CFR 1 .121(c). For example, the use of a single bracket set ([]) is not compliant with 37 
CFR 1.121(c)(2); rather a strike-through should be used or a double bracket ([[]]) may be used 
when deleting five or fewer characters or when a strike-through is not easily perceived . The 
response has been considered as a bona fide attempt, however, any further submissions not 
compliant with 37 CFR 1.121(c) will be treated as such, according to MPEP §714. 
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4. Applicant's response of 4/10/2006 (p. 1 1) argues that "undesired" is described in the 
specification. However, this argument is moot, as applicant has removed this language from the 
claims. 

5. Applicant's response of 4/10/2006 (pp. 1 1-12) argues that "non-virus" is to be read with 
regards to its plain and ordinary meaning, as evidenced by dictionary definitions. Applicant cites 
a definition from the American Heritage Dictionary of the English Language. Therefore, the 
term "virus" and as such it's opposite "non- virus" will be interpreted with regards to their plain 
and ordinary meaning. Applicant's definition is considered appropriate; as well, the Examiner 
cites Kephart's definition (col. 1, lines 17-21). Therefore, the rejections under 35 U.S.C. §112 
are withdrawn. 

6. Applicant's response of 4/10/2006 (p. 12) argues that "the Kephart reference teaches only 
the identification of virus signatures from a list or from files containing invariant viral code for 
the purpose of future extraction (col. 5, lines 57-61)", but "applicant's logic differentiates 
between the identification of computer viruses and computer programs banned from use and 
performs the identification of the computer programs banned from use after the computer virus 
identification". However, since Kephart's invention identifies both virus and non- virus 
(programs banned from use), it is an inherent feature of the Kephart invention, if run more than 
once, to identify a program banned from use after identifying a virus. For instance, even if on 
each pass through the signature list, the viruses were checked last, on the next running of the 
checker, the program will have identified the banned programs after the previous identification 
of viruses. Further, one of ordinary skill in the art would have been motivated to prioritize the 
identification of viruses before identifying the computer programs banned from use because it is 
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well known to identify the most severe threats first. In this case, if a virus is attached to a 
system, this would be a more severe threat than a non-virus program which is not self- 
replicating. This is also common in intrusion detection using signatures, where the most severe 
intrusions are identified first and then the less severe intrusions are identified. 

7. Applicant's response of 4/10/2006 (p. 13) also introduces new claims. Specifically, claim 
43 recites (similar to claim 44) "wherein the at least one non-virus computer program includes at 
least one of a game or a data streaming program". However, Kephart discloses detecting and 
removing both virus and non-virus programs. Lavasoft (previously cited) teaches detecting and 
removing adware. The instantly cited patent to Fuller discloses that adware streams data. 
Therefore, it is submitted that the limitation regarding the non-virus programs including data 
streaming programs is an obvious variation over these references. Regarding claim 44, Kephart, 
as modified by Lavasoft and Fuller, lacks the non-virus programs including games, However, 
Brown teaches that it is known for an employer to prevent the addition of games onto an 
employee computer (col. 4, lines 10-12). Therefore, it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to modify Kephart such that the non- 
virus computer programs further include games. One of ordinary skill in the art would have been 
motivated to perform such a modification to enable employers to prevent the addition of the 
games to employee computers, as taught by Brown (col. 4, lines 10-12). 

8. Applicant's response of 4/10/2006 (p. 13) introduces additional claim 45, reciting that the 
anti-virus logic of a plurality of end users each includes a different selected set of computer 
programs banned from use. However, Kephart discloses the user is the entity supplying a file 
from which signatures are extracted (col. 5, lines 57-61). Therefore, it is an inherent feature of 
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Kephart that each end user anti computer virus logic includes a different selected set of computer 
programs (user-selected signatures) banned from use. 

9. Applicant's response of 4/10/2006 (p. 13) introduces an additional claim 46. Kephart 
lacks receiving a file access request and scanning the file, as claimed. However, Golds teaches 
that it is known to stack software modules as file system filter drivers that intercept file system- 
directed requests to a base file system for virus scanning fl[3 & 1f8) and send a failed 
response/return if the operation is not passed fl[3 1). Therefore, it would have been obvious to 
one having ordinary skill in the art at the time the invention was made to modify Kephart to 
intercept a file access request and perform an anti-virus scan and return a fail response to an 
operating is the anti-virus scan is not passed to filter requests to a file system as is known in the 
art. Kephart is silent to the limitation that if said anti-virus scan is passed, a scan for the 
computer programs banned from use is performed. However, it is inherent in Kephart, as 
modified, that all signatures will be scanned and therefore, if one signature does not match a file, 
the next will be checked. Therefore, since Kephart scans a file with respect to virus and non- 
virus files, it is inherent that when a virus signature does not match the file being scanned, the 
file will be scanned for the remaining signatures, at least one corresponding to a non- virus file. 

Claim Rejections - 35 USC § 102 

10. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 
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11. Claims 1,4,7, 13, 15, 18, 21, 27, 29, 32, 35, 41 & 45 are rejected under 35 U.S.C. 102(b) 
as anticipated by or, in the alternative, under 35 U.S.C. 103(a) as obvious over U.S. Patent 
5,452,442 to Kephart. 

Regarding claims 1, 4, 7, 13, 15, 18, 21, 27, 29, 32, 35 & 41, Kephart discloses a user 
controlled program specifying logic (col. 5, lines 57-61) to specify said at least one computer 
program to be banned from use (col. 1, lines 35-49 & col. 5, lines 57-61), said at least one 
computer program comprising an undesired, non-virus computer program (col. 1, lines 15-34), 
and banned program identifying data generating logic responsive to said user controlled program 
specifying logic to generate banned program identifying data/signature (col. 5, lines 57-61) for at 
least one computer program to be banned from use, said banned program identifying data being 
operable to control anti computer virus logic/scanner (col. 1, lines 35-49) to identify computer 
programs banned from use (col. 1, lines 35-49 & col. 2, lines 5-12). While Kephart is silent 
regarding the order of identifying computer viruses and programs banned from use, it is an 
inherent feature of Kephart' s invention that, if the product/apparatus/method is executed more 
than once, as is common in the art, regardless of whether viruses or non- viruses are identified 
first on the first execution, the second execution will have identified non-viruses after viruses 
because it identifies both each time. Further, one having ordinary skill in the art would have 
been motivated to modify Kephart in such a way that the system identifies the non-viruses after 
the viruses. One of ordinary skill in the art would have been motivated to perform such a 
modification to eliminate the most severe or crucial threats (viruses) first. 

Regarding claim 45, Kephart discloses the user supplying a file from which signatures are 
extracted (col. 5, lines 57-61). Therefore, it is an inherent feature of Kephart that each end user 
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anti computer virus logic includes a different selected set of computer programs banned from 
use. 



Claim Rejections - 35 USC § 103 

12. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

13. Claims 2, 8 5 16, 22, 30 & 36 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Kephart, as applied to claims 1, 7, 15, 21, 29 & 35 above, in further view of "Bad IDEA" 
by Peter Szor (Szor), in further view of "Cryptography in Everyday Life" by Sarah Simpson 
(Simpson). Kephart lacks encrypting the banned program identifying data/signatures with a 
private key. However, Szor teaches that to prevent modification of antivirus signature files, the 
files should be encrypted (p. 19, col. 2). Therefore, it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to modify Kephart to encrypt the 
banned program identifying data/signatures. One of ordinary skill in the art would have been 
motivated to perform such a modification to prevent modification of antivirus signature files, as 
taught by Szor (p. 19, col. 2). As modified, Symantec lacks using a private key. However, 
Simpson teaches that by encrypting a file with a private key, the sender of the encrypted file can 
be verified by decrypting it with the corresponding public key (p. 1, 11). Therefore, it would 
have been obvious to one having ordinary skill in the art at the time the invention was made to 
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use a private key. One of ordinary skill in the art would have been motivated to perform such a 
modification to verify the creator of the signature files, as taught by Simpson (p. 1). 

14. Claims 5, 19 & 33, are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart, as applied to claims 4, 18 & 32 above, in further view of "Heuristic Anti-Virus 
Technology" by Veldman. Kephart discloses detecting known viruses, but lacks the banned 
program identifying data including heuristic data identifying one or more behavioral 
characteristics. However, Veldman teaches that using heuristics and examining behaviors of a 
program allows detection of unknown viruses (§1 & §2.1). Therefore, it would have been 
obvious to one having ordinary skill in the art at the time the invention was made to including in 
the identifying data, heuristic data identifying one or more behavioral characteristics. One of 
ordinary skill in the art would have been motivated to perform such a modification to detect 
unknown computer viruses, as taught by Veldman (§1,^1 & §2.1). 

15. Claims 10, 24 & 38 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart, Szor and Simpson, as applied claims 8, 22 & 36 above, in further view of U.S. Patent 
5,844,986 to Davis. Kephart, as modified above, lacks storing the identifying data in a secure 
memory region. However, Davis teaches that to prevent a virus from corrupting a BIOS (secure 
flash memory), an authentication and validation procedure is required before the contents of the 
BIOS memory can be modified (col. 1, lines 32-45, lines 63-67 & col. 2, lines 1-7). Therefore, it 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to store the identifying data in a secure memory region (memory requiring authentication). 



Application/Control Number: 09/809,073 Page 9 

Art Unit: 2134 

One of ordinary skill in the art would have been motivated to perform such a modification to 
prevent a virus from corrupting the identifying data, as taught by Davis (col. 1, lines 32-45 & 63- 

67). 



16. Claims 11-12, 25-26 & 39-40 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Kephart, as applied to claims 7, 21 & 35 above, in view of "Norton Antivirus User's 
Guide", by Symantec Corporation (Symantec). 

Regarding claims 1 1, 25 & 39, Kephart, as modified above, lacks explicitly triggering a 
banned program action. However, Symantec teaches that it is known to alert a user for a 
response (pp. 39-40). Therefore, it would have been obvious to one having ordinary skill in the 
art at the time the invention was made to modify Kephart' s scanner to trigger a banned program 
action such as deleting the banned computer program (p. 40). One of ordinary skill in the art 
would have been motivated to perform such a modification to allow the user to rid the computer 
of the virus if the repair is not successful, as taught by Symantec (pp. 39-40). 

Regarding claim 12, 26 & 40, Kephart, as modified above, lacks responding to an 
absence of said user generated banned program identifying data. However, Symantec teaches 
that it is important to have the most up-to-date virus signatures/banned program identifying data 
(p. 1 1) and that the signatures can be updated by restoring them from a remote source (p. 1 8). 
Therefore, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify Kephart, as modified above, to respond to an absence of banned 
program identifying data by restoring the data from a remote source. One of ordinary skill in the 
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art would have been motivated to perform such a modification to keep the system up-to-date, as 
taught by Symantec (pp. 11 & 18). 

17. Claims 6, 14, 20, 28, 34 & 42 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Kephart, as applied to claims 1, 7, 15, 21, 29 & 35 above, in view of U.S. Patent 6,694,434 
to McGee et al. (McGee). Kephart lacks the banned program identifying data comprising data 
identifying permitted compute programs with all computer programs not matching a permitted 
computer program being identified as a computer program banned from use. However, McGee 
teaches that it would be desirable to control whether a calling application can execute on a 
processor, since unauthorized applications can be inadvertently downloaded onto a system (col. 
2, lines 35-41). McGee further discloses that each calling application's unique application 
verification data is generated upon it's calling and compared to a list of authorized programs 
(col. 3, line 64 - col. 4, line 4). Therefore, it would have been obvious to one having ordinary 
skill in the art at the time the invention was made to modify Kephart so that the banned program 
identifying data comprising data identifying permitted compute programs with all computer 
programs not matching a permitted computer program being identified as a computer program 
banned from use. One of ordinary skill in the art would have been motivated to perform such a 
modification to protect a computer against inadvertently downloaded unauthorized programs, as 
taught by McGee (col. 2, lines 35-41 & col. 3, line 64 - col. 4, line 4). 

18. Claim 43 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart, as 
applied to claim 1, in view of "Ad-aware" by Lavasoft and U.S. Patent 6,216,1 12 to Fuller et al. 
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(Fuller). Kephart lacks the non-virus computer program including at least one of a game and a 
data streaming program. However, Lavasoft teaches that it is known to detect and remove 
spy ware and adware (p. 1) because spyware can, for example, change a user's system (p. 1). 
Therefore, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify Kephart to include spyware/adware in the signatures, allowing the 
anti-virus logic to delete the ad ware/spy ware. One of ordinary skill in the art would have been 
motivated to perform such a modification because detecting and removing adware and spyware 
is known in the art as beneficial, as taught by Lavasoft (p. 1). As modified, Kephart lacks 
explicitly a data streaming program. However, Fuller teaches that it is known in the art to install 
adware in a computer system, where the adware contacts servers and downloads new 
advertisements (streams data) (abstract). Therefore, it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to further modify Kephart to use the 
anti-virus software to remove data streaming programs. One of ordinary skill in the art would 
have been motivated to perform such a modification because adware streams data, as taught by 
Fuller (abstract). 

19. Claim 44 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart, 
Lavasoft, and Fuller, in further view of U.S. Patent 5,859,968 to Brown et al. (Brown). 
Regarding claim 44, Kephart, as modified above by Lavasoft and Fuller, lacks the non-virus 
programs further including games. However, Brown teaches that it is known for an employer to 
prevent the addition of games onto an employee computer (col. 4, lines 10-12). Therefore, it 
would have been obvious to one having ordinary skill in the art at the time the invention was 
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made to modify Kephart such that the non-virus computer programs further include games. One 
of ordinary skill in the art would have been motivated to perform such a modification to enable 
employers to prevent the addition of the games to employee computers, as taught by Brown (col. 
4, lines 10-12). 

20. Claim 46 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart, as 
applied to claim 1 above, in further view of U.S. Patent Application Publication 2001/0020245 to 
Golds et al. (Golds). Kephart, as described above, lacks receiving a file access request and 
scanning the file. However, Golds teaches that it is known to stack software modules as file 
system filter drivers that intercept file system-directed requests to a base file system for virus 
scanning fl[3 & If 8 ) ^ sen d a failed response/return if the operation is not passed fl|31). 
Therefore, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify Kephart to intercept a file access request and perform an anti- 
virus scan and return a fail response to an operating is the anti-virus scan is not passed. One of 
ordinary skill in the art would have been motivated to perform such a modification to filter 
requests to a file system as is known in the art, as taught by Golds flfl[3 & 8). As modified, 
Kephart is silent as to the limitation that if said anti-virus scan is passed, a scan for the computer 
programs banned from use is performed. However, it is inherent in Kephart that all signatures 
will be scanned and therefore, if one signature does not match a file, the next will be checked. 
Therefore, since Kephart scans a file with respect to virus and non-virus files, it is inherent that 
when a virus signature does not match the file being scanned, the file will be scanned for the 
remaining signatures, at least one corresponding to a non-virus file. 
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Conclusion 

21 . The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

a. The '920 patent is cited for teaching identifying viruses before other non-virus 
data (cols. 4-5), but lacks motivation for doing so. 

b. The patent publication to Le-Rouzo is cited for teaching detecting non-virus 
programs, but does not constitute prior art. 

22. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

23. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael J. Simitoski whose telephone number is (571) 272-3841 . 
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The examiner can normally be reached on Monday - Thursday, 6:45 a.m. - 4:15 p.m.. The 
examiner can also be reached on alternate Fridays from 6:45 a.m. - 3:15 p.m. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jacques Louis Jacques can be reached at (571) 272-6962. 

Any response to this action should be mailed to: 

Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 
Or faxed to: 

(571)273-8300 

(for formal communications intended for entry) 

Or: 

(571) 273-3841 (Examiner's fax, for informal or draft communications, please 
label "PROPOSED" or "DRAFT") 

Any inquiry of a general nature or relating to the status of this application or proceeding should 
be directed to the receptionist whose telephone number is (571) 272-2100. 

Information regarding the status of an application may be obtained from the Patent 

Application Information Retrieval (PAIR) system. Status information for published applications 

may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 

applications is available through Private PAIR only. For more information about the PAIR 

system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 

system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 




